Missing dots from email addresses opens 20GB data leak

[Linuxfever]

Security researchers have captured 120,000 emails intended for Fortune 500 companies by exploiting a basic typo. The emails included trade secrets, business invoices, personal information about employees, network diagrams and passwords.

Researchers Peter Kim and Garrett Gee did this by buying 30 internet domains they thought people would send emails to by accident (a practice known as typosquatting).

The domain names they chose were all identical to subdomains used by Fortune 500 companies save for a missing dot.

Having purchased the domains they simply sat back and watched as users mistakenly sent them over 120,000 emails in six months.

Kim and Garrett have not identified their targets but have revealed that they were chosen from a list of 151 Fortune 500 companies they regarded as vulnerable to their variation of typosquatting. The list is jam-packed with household names like Dell, Microsoft, Halliburton, PepsiCo and Nike.

The emails they collected included some worryingly sensitive corporate information, including:

• Passwords for an IT firm's external Cisco routers
• Precise details of the contents of a large oil company's oil tankers
• VPN details and passwords for a system managing road tollways]

Read more

 

[MetalShaun]

Haha, thats brilliant. It's always the simple things that are the most impressive.

 

[Tom172]

Bad spelling opens up security loophole

A missing dot in an email address might mean messages end up in the hands of cyber thieves, researchers have found.

By creating web domains that contained commonly mistyped names, the investigators received emails that would otherwise not be delivered.

Over six months they grabbed 20GB of data made up of 120,000 wrongly sent messages.

Some of the intercepted correspondence contained user names, passwords, and details of corporate networks.

http://www.bbc.co.uk/news/technology-14842691

 

[jamescv7]

RE: Bad spelling opens up security loophole

This is a must carefully type some websites caused misspelled websites could not only lead to non existent but it can produce security risk.

Example was a nightmare domain of goggle that said its installed a fake AV called Spysheriff.

 

[Dejan]

Eh, people can be dumb, sending sensitive info like that without even double-checking the email address..

 

[Deleted member 178]

if everybody was smart, the world will be a peaceful place.

 

[JurgNet]

Haha, thats brilliant. It's always the simple things that are the most impressive.

LOL Fair enough
Regards
WA